Info-ZIP Zip 3.0 when the -T and -TT command-line options are used allows attackers to cause a denial of service (invalid free and application crash) or possibly have unspecified other impact because of an off-by-one error. NOTE: it is unclear whether there are realistic scenarios in which an untrusted party controls the -TT value given that the entire purpose of -TT is execution of arbitrary commands

🗓️ 18 Aug 2020 07:00:00Reported by MicrosoftType

Info-ZIP Zip 3.0 with -T and -TT may cause denial of service or crash due to an off-by-one error.

Reporter	Title	Published	Views	Family All 33
AlpineLinux	CVE-2018-13410	6 Jul 201819:29	–	alpinelinux
BDU FSTEC	The vulnerability of zip file compression software lies in the use of memory after it is freed, allowing an attacker to access confidential information or cause service failures.	22 Jul 202100:00	–	bdu_fstec
CBLMariner	CVE-2018-13410 affecting package zip 3.0-5	9 Sep 202006:09	–	cbl_mariner
CBLMariner	CVE-2018-13410 affecting package zip for versions less than 3.0-6	19 Mar 202417:21	–	cbl_mariner
CBLMariner	CVE-2018-13410 affecting package zip for versions less than 3.0-5	9 Apr 202206:51	–	cbl_mariner
CVE	CVE-2018-13410	6 Jul 201819:00	–	cve
Cvelist	CVE-2018-13410	6 Jul 201819:00	–	cvelist
Debian CVE	CVE-2018-13410	6 Jul 201819:00	–	debiancve
Tenable Nessus	EulerOS 2.0 SP8 : zip (EulerOS-SA-2019-1788)	25 Jul 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : zip (EulerOS-SA-2019-1812)	23 Aug 201900:00	–	nessus